In general, a dialysis machine is used as a substitute for the natural kidney functions of a human body. As such, the dialysis machine cleanses the blood of the natural accumulation of bodily wastes and separates the wastes from the blood outside of or extracorporeally of the body. The separated wastes are discharged, and the cleansed blood is returned to the body.
The wastes are separated from the blood in a dialyzer. The dialyzer includes an internal housing which is separated by a porous membrane into a blood side or compartment and a dialysate side or compartment. The blood removed from the patient flows through the blood side of the dialyzer. A prepared solution of dialysate is passed through the dialysate side of the dialyzer. The wastes from the blood pass through the membrane by osmosis, ionic transfer or fluid transport into the dialysate and, depending upon the type of dialysis treatment, desirable components from the dialysate may pass in the opposite direction through the membrane and into the blood. The transfer of the wastes into the dialysate cleanses the blood while allowing the desired components from the dialysate to enter the bloodstream.
As is apparent, the dialysis machine must be properly operated to perform effective dialysis in a safe and reliable manner. With the patient's blood being removed and passed through an extracorporeal flow path, care must be taken that the blood is not contaminated and is handled safely. The dialysate, which flows in a hydraulics flow path, must be controlled in both composition and physical characteristics. The mixture of components in the dialysate must also be correct and safe. The ability to clean the hydraulics flow path prior to use is essential to avoid the possibility of introducing undesirable microorganisms into the blood.
In addition to controlling the operational functions, the functionality of the dialysis machine and the condition of the patient must be monitored for safety or protective purposes. For example, the condition and integrity of the dialyzer medium must be monitored to detect a failure which would allow the dialysate to directly enter the blood and to detect any obstruction which would inhibit or terminate the flow of wastes from the blood across the membrane and into the dialysate. Monitoring certain bodily functions of the patient allows the early detection of a potentially risky condition developing in the patient during treatment.
Modern dialysis machines incorporate a large number of safety or protective features in a safety system, because of the potential for serious consequences resulting from a system failure or unsafe patient condition. The safety system includes sensors located in the extracorporeal and hydraulics flow paths to derive signals representative of the operating conditions or parameters. From these sensor signals the safety system evaluates safety conditions of the machine and the patient. In addition, all known dialysis machines employ separate and distinct safety and control system microcontrollers to separately execute the safety and the normal operating functions of the dialysis machine. A safety system microcontroller executes the safety functions based on signals from the sensors and its own software program, and a separate control system microcontroller executes the normal operating control functions based on the signals from the sensors and its own separate software program.
Upon recognizing a safety or risk condition, the safety system microcontroller places the dialysis machine in a safe state to prevent or greatly reduce the risk of injury to the patient. Under such conditions the safety microcontroller overrides any commands delivered by the control system microcontroller. So long as a safety or risk condition is not detected, the safety microcontroller exercises little or no control but instead allows the control system microcontroller to exercise normal control over the operation of the dialysis machine. The control system microcontroller thus assures that the dialysis treatment will proceed as the operator has selected, under normal conditions. Thus, the control system microcontroller exercises control over the normal operating functionality, and the safety system microcontroller exercises the ultimate and predominant control over the entire dialysis machine in safety and protective situations.
In large measure, the use of the two separate control system and safety system microcontrollers is as a result of the relatively stringent standards established by health and safety and governmental groups. These standards have required that the dialysis machine respond to catastrophic and lesser forms of failure by placing the patient in a safe condition despite the failure. The two-microcontroller approach satisfies these standards due to the redundancy of control by both the safety system and control system microcontrollers. If a failure occurs in the control system microcontroller, the safety system microcontroller assures that the necessary safety and protective state will be achieved. If a failure occurs in the safety system microcontrollers, the control system microcontroller is capable of exercising adequate control over the system to maintain a safe state.
Furthermore by maintaining the safety and control functionality in separate software, changes in control system functionality can be made without adversely affecting the safety system software. The separated safety system and control system software also satisfies an additional provision of the safety standards which specifies that an actual or potential change to the safety system software will require re-validation of the safety system functionality. Re-validation is a process during which the functionality of the safety system must be demonstrated and confirmed as safe. Re-validation is a time consuming and expensive task, so the separate division of the control system software from the safety system software avoids the possibilities and costs associated with having to re-validate the safety system.
As a consequence of the practical considerations and the relevant safety standards described briefly above, all known prior dialysis machines have followed the two separate microcontroller systems approach. With the advent of stricter governmental and other economic controls over the costs of medical equipment and treatments, especially those regularly recurring treatments of significant cost such as dialysis treatments, considerable emphasis has been placed on reducing treatment costs. A portion of the treatments cost is attributable to the costs of the dialysis machine and its maintenance. It is therefore desirable to reduce costs associated with the purchase and maintenance of dialysis machines as one approach to reducing the costs and expenses of dialysis treatments.
These and other considerations have contributed to the evolution of the present invention which is summarized below.